{"id":"CVE-2021-21264","published":"2021-05-03T16:00:18Z","modified":"2024-08-03T18:09:14Z","title":"Bypass of fix for CVE-2020-26231, Twig sandbox escape","vendor":"octobercms","product":"october","tier":"tail","description":{"text":"October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231 (fixed in 1.0.470/471 and 1.1.1) was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247. An authenticated backend user with the `cms.manage_pages`, `cms.manage_layouts`, or `cms.manage_partials` permissions who would **normally** not be permitted to provide PHP code to be executed by the CMS due to `cms.enableSafeMode` being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having `cms.enableSafeMode` enabled, but would be a problem for anyone relying on `cms.enableSafeMode` to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP. Issue has been patched in Build 472 (v1.0.472) and v1.1.2. As a workaround, apply https://github.com/octobercms/october/commit/f63519ff1e8d375df30deba63156a2fc97aa9ee7 to your installation manually if unable to upgrade to Build 472 or v1.1.2.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.2,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00262,"percentile":0.18086,"provenance":"source"},"cwes":[{"id":"CWE-862","name":"Missing Authorization"}],"references":[{"url":"https://github.com/octobercms/october/security/advisories/GHSA-fcr8-6q7r-m4wg","tags":["x_refsource_CONFIRM"]}],"priority":{"score":7.3,"factors":[{"name":"EPSS percentile","points":3.62},{"name":"CVSS severity","points":3.64}]},"vendorSlug":"octobercms","affectedVersions":[{"vendor":"octobercms","product":"october","versions":["1.0.471","1.1.1"]}],"affected":[{"ecosystem":"Packagist","package":"october/cms","vulnerableRanges":[">=1.0.471, <1.0.472",">=1.1.1, <1.1.2"],"patched":["1.0.472","1.1.2"],"from":["GHSA-fcr8-6q7r-m4wg"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1058","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-octobercms-october-cve-2020-15247","parents":[{"from":"CVE-2020-26231","to":"CVE-2021-21264","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"A bypass of CVE-2020-26231 (fixed in 1.0.470/471 and 1.1.1) was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247.","from":"CVE.org","in":"CVE-2021-21264"},{"kind":"similar","provenance":"machine","score":0.89,"basis":"same product + CWE + description similarity"}]}]}}